CCOA Technology Essentials — Timed 10 Questions

Question 1

A SOC analyst observes excessive traffic on port 443 originating from an internal server to an unknown external IP. Which command should the analyst run on a Linux-based server to identify the specific process ID (PID) associated with this connection?

10 minute time limit — choose an answer to begin.

Accepted Answer

lsof -i :443. The 'netstat -tulpn' or 'ss -tulpn' command is standard for mapping open ports to specific process IDs in Linux environments.

Answer

ps -ef | grep 443

Answer

route -n

Answer

tcpdump -i eth0 port 443

Question 2

A cloud-based application is suffering from slow database queries. You suspect a misconfigured connection pool. Which log type in the cloud provider's console should you examine first?

Accepted Answer

CloudWatch Application Insights. Performance logs or Application Performance Monitoring (APM) logs are the standard tools for identifying bottlenecks in database connectivity.

Answer

Audit logs

Answer

Flow logs

Answer

IAM logs

Question 3

You are hardening a web server. Which directive in an Apache configuration file helps prevent Clickjacking attacks?

Accepted Answer

X-Frame-Options: SAMEORIGIN. The 'X-Frame-Options' header prevents the site from being embedded in iframes, which is the primary vector for clickjacking.

Answer

Strict-Transport-Security

Answer

Content-Security-Policy: default-src 'self'

Answer

X-XSS-Protection: 1

Question 4

You are managing a Linux server that has become unresponsive. You suspect a 'fork bomb'. How can you limit the number of processes a user can run to prevent this?

Accepted Answer

Modify /etc/security/limits.conf. The 'ulimit' command, specifically the 'u' flag, allows setting limits on the number of processes per user.

Answer

Change the root password

Answer

Disable the swap partition

Answer

Use iptables

Question 5

In an Active Directory environment, which tool is used to monitor for unauthorized modifications to Group Policy Objects (GPOs)?

Accepted Answer

Group Policy Management Console (GPMC) reports. Active Directory replication and audit logs are monitored to detect changes to GPOs, and the 'Advanced Audit Policy Configuration' can be set to log these events.

Answer

Active Directory Users and Computers

Answer

Registry Editor

Answer

DNS Manager

Question 6

A security analyst at a financial firm is reviewing a suspicious email that appears to come from a known vendor. The email contains a link to an external site that prompts the user to enter credentials. The analyst suspects a phishing attack. Which of the following should the analyst examine FIRST to determine the legitimacy of the email?

Accepted Answer

The email's SMTP headers, including Received and Return-Path fields.. SMTP headers are the primary source of truth for email origin and routing. They contain Received chains that show the path the message took, and Return-Path that indicates the envelope sender. Attackers often spoof the From header, but the Received headers are added by mail servers and are harder to fake. Analyzing these headers first allows the analyst to identify inconsistencies and potential spoofing.

Answer

The email's digital signature, if present, using the sender's public key.

Answer

The email's attachment file hash, comparing it to known malware databases.

Answer

The email's SPF, DKIM, and DMARC alignment by querying DNS records.

Question 7

A security analyst is reviewing network traffic and observes a high volume of DNS queries for randomly generated subdomains of a single domain, such as 'a1b2c3.example.com', 'd4e5f6.example.com'. The queries are of type TXT and the responses contain long strings of encoded data. Which technique is most likely being used?

Accepted Answer

DNS tunneling for data exfiltration. The use of randomly generated subdomains under a single domain, combined with TXT record queries and encoded responses, is a hallmark of DNS tunneling. Attackers use this to exfiltrate data or maintain command-and-control by hiding data in DNS traffic, which is often allowed through firewalls. Other techniques like DGA, cache poisoning, or fast flux do not match the observed pattern of encoded data in subdomains.

Answer

DNS cache poisoning attack

Answer

Domain generation algorithm (DGA) for malware command-and-control

Answer

Fast flux DNS for botnet resilience

Question 8

A security analyst is examining a Linux server that is suspected of being compromised. The analyst runs `ss -tulpn` and observes an unfamiliar process listening on TCP port 4444. To identify the process executable and its command line, which command should the analyst use next?

Accepted Answer

cat /proc//cmdline. The /proc filesystem exposes detailed process information. Reading /proc//cmdline yields the full command line, and /proc//exe resolves to the executable path. This is the most reliable method to identify exactly what binary is listening and with what arguments, which is essential for triage of a suspected compromise.

Answer

netstat -tulpn | grep 4444

Answer

lsof -i :4444

Answer

ps -p <PID> -o pid,cmd

Question 9

A security analyst is implementing TLS for a new web application. The analyst must select cipher suites that provide forward secrecy and strong encryption. Which two of the following cipher suites meet these requirements? (Choose two.)

Accepted Answer

TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384. Forward secrecy requires an ephemeral key exchange such as ECDHE or DHE, ensuring that session keys are not derivable from the server's long-term private key. Strong encryption in modern TLS typically means using AEAD modes like GCM. The cipher suites TLS_ECDHE_RSA_WITH_AES_128_GCM_SHA256 and TLS_ECDHE_ECDSA_WITH_AES_256_GCM_SHA384 both use ECDHE for forward secrecy and AES-GCM for authenticated encryption. The other options either lack forward secrecy (RSA, PSK) or use CBC mode, which is not considered as strong due to padding oracle vulnerabilities.

Answer

TLS_DHE_RSA_WITH_AES_128_CBC_SHA256

Answer

TLS_PSK_WITH_AES_128_GCM_SHA256

Answer

TLS_RSA_WITH_AES_256_CBC_SHA

Question 10

A CCOA analyst is reviewing a capture from a mirrored switch port and needs to confirm whether a suspicious outbound session used TLS 1.3 with a valid server certificate chain. The analyst must determine the negotiated protocol version and the issuer of the leaf certificate without altering the traffic. Which Wireshark capability should the analyst rely on?

Accepted Answer

Display filter tls.handshake.type == 2, then inspect the Server Hello extensions and the Certificate message fields in the packet detail pane.. Confirming TLS 1.3 and the certificate issuer requires reading the Server Hello supported_versions extension plus the Certificate handshake message in the dissected packet details. Port-based inference and raw payload inspection fail because TLS 1.3 encrypts handshake material, while Client Hello filtering captures the wrong direction of the exchange. Only direct inspection of the server handshake fields yields accurate, defensible evidence.

Answer

Apply the filter ssl.handshake.type == 1 and export the associated objects to reconstruct the server certificate from the TLS record layer.

Answer

Use the protocol hierarchy statistics window to confirm TLS traffic exists, then infer the version from the port number and assume the issuer from the destination domain.

Answer

Display filter tcp.port == 443, then read the raw TCP payload bytes to locate the ASCII strings for the negotiated version and issuer name.